Lunar Calendar - 中国老黄历

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:11 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward TianAPI lunar-calendar lookup, but users should handle the API key carefully and expect some documentation/runtime bugs.

Install only if you are comfortable sending a dedicated TianAPI key and requested date to TianAPI. Prefer the TIANAPI_LUNAR_CALENDAR_KEY environment variable, avoid passing the key on the command line, do not commit scripts/.env, and use a restricted key you can rotate. Also expect the current script to need fixes before it runs as documented.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:24

Finding

API Key Exposure Through Command-Line Arguments

Content

View full analysis

# Query a specified Gregorian date python3 scripts/fetch_lunar_calendar.py # Query a specified lunar date python3 scripts/fetch_lunar_calendar.py 1 ``` The implementation also explicitly accepts an API key as a named command-line argument: ```python parser = argparse.ArgumentParser(description="TianAPI Lunar Calendar Fetcher") parser.add_argument("--key", help="API Key (optional; environment variable takes precedence)") parser.add_argument("--date", help="Query date (for example, 2024-07-13 or 2024-6-8)") ``` ### Technical Analysis The Skill encourages users to supply a TianAPI credential as a command-line argument. Secrets passed this way can be retained in interactive shell history and may be observable through process-inspection facilities while the process is running. They can also be captured by terminal logging, command auditing, debugging tools, or automation logs. The documentation uses positional arguments, while the implementation accepts `--key`. This inconsistency makes the documented examples nonfunctional, but the underlying insecure credential channel remains available through `--key`. Sending an authentication credential is necessary for the declared lunar-calendar service. Exposing that credential through process arguments is not necessary because the script already supports an environment variable and a local configuration file. ### Attack Path 1. A user follows the Skill's guidance or invokes the supported `--key` option with a valid Tia ...[truncated 789 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_lunar_calendar.py:79

Finding

API Key Transmitted in the Request URL Query String

Content

View full analysis

``` HTTPS encrypts the URL path and query while the request is in transit, so a passive network observer cannot ordinarily read the key. However, URL query strings are commonly retained by destination-server access logs, reverse proxies, application-performance monitoring systems, exception reports, debugging output, and HTTP diagnostic tooling. The network request itself is necessary and is sent only to the documented TianAPI endpoint. The concern is the credential's placement in the URL rather than an unrelated or covert data transfer. If TianAPI mandates query-string authentication, this risk cannot be eliminated solely by the client, but it should be explicitly acknowledged and mitigated. ### Attack Path 1. The user configures a valid TianAPI credential and runs the Skill. 2. The script embeds the credential into the request URL. 3. A server, proxy, monitoring product, debugger, or diagnostic facility records the complete URL. 4. An individual with access to those records extracts the `key` query parameter. 5. The individual reuses the key directly against TianAPI until it is revoked, rotated, restricted, or exhausted. ### Impact Assessment Compromise is limited to the TianAPI authorization represented by the exposed key; this finding does not grant local system access. Potential effects include ...[truncated 150 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:28

Finding

Plaintext API Key Stored in an Unprotected .env File

Content

View full analysis

scripts/.env ``` The script then reads the plaintext file: ```python env_file = Path(__file__).parent / ".env" if env_file.exists(): try: content = env_file.read_text(encoding="utf-8") for line in content.splitlines(): line = line.strip() if line.startswith(f"{ENV_KEY_NAME}="): return line.split("=", 1)[1].strip().strip('"\'') except Exception: pass ``` ### Technical Analysis The documentation recommends writing the API key to `scripts/.env` using ordinary shell redirection. It does not instruct the user to apply restrictive file permissions, exclude the file from version control, or use a credential manager. The key is necessarily stored in plaintext for this implementation to read it. Without permission controls, the file may be accessible to other local users depending on the user's `umask` and directory permissions. It may also be copied into backups, archives, build contexts, support bundles, or source-control commits. No `.gitignore` file or equivalent exclusion rule is present in the audited project structure. ### Attack Path 1. A user follows the documentation and creates `scripts/.env` containing a valid API key. 2. The file is created with permissions derived from the user's current `umask`, without an explicit restrictive mode. 3. The file is accidentally committed, archived, backed up, included in a build context, or read by another account with filesystem access. 4. An unauthorized party extracts the plaintext credential. 5. The party reuses it to make TianAPI requests under the victim's account. ### Impact A ...[truncated 316 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

从高层目的看，代码与描述都围绕“查询中国老黄历”展开，没有发现无关的敏感能力或额外资源访问；它会读取 API Key（命令行、环境变量、.env）并向 TianAPI 发起网络请求，这属于实现该功能所必需的支持行为。但严格按“描述是否准确代表实际行为”评估，仍应判定为不匹配：一是声明提到可获取吉时等信息，而渲染逻辑只输出日期、农历、生肖、冲煞、宜忌、吉神方位、胎神方位，没有吉时字段处理；二是代码/注释声称支持 --lunar 和 --json，但 argparse 实际只定义了 --key、--date、--type，随后又访问不存在的 args.lunar 与 args.json，会导致运行失败。因此描述的可用能力与代码真实可执行行为存在实质偏差。

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill instructs users to place an API key into scripts/.env and also shows passing the secret directly on the command line. Both patterns materially increase credential exposure risk because .env files are often accidentally committed or left world-readable, and command-line arguments can be visible to shell history, process inspection, or execution logs.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

# 方式一：环境变量（推荐，一次配置永久生效）
    export TIANAPI_LUNAR_CALENDAR_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_LUNAR_CALENDAR_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

This line explicitly demonstrates writing the API key to a local .env file in the scripts directory, creating a persistent plaintext secret on disk. In the context of an agent skill that also uses file access and network access, this makes accidental disclosure, repository leakage, and reuse by other local processes more likely.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

export TIANAPI_LUNAR_CALENDAR_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_LUNAR_CALENDAR_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入
    python3 scripts/fetch_lunar_calendar.py 你的APIKey 2024-07-13

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_lunar_calendar.py (reported line 23)May include surrounding context.

python

Env Config:
    export TIANAPI_LUNAR_CALENDAR_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_LUNAR_CALENDAR_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_lunar_calendar.py (reported line 43)May include surrounding context.

python

Env Config:
    export TIANAPI_LUNAR_CALENDAR_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_LUNAR_CALENDAR_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_lunar_calendar.py (reported line 48)May include surrounding context.

python

Env Config:
    export TIANAPI_LUNAR_CALENDAR_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_LUNAR_CALENDAR_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_lunar_calendar.py (reported line 57)May include surrounding context.

python

Env Config:
    export TIANAPI_LUNAR_CALENDAR_KEY=your_api_key
    # 或在脚本同级目录创建 .env 文件: TIANAPI_LUNAR_CALENDAR_KEY=your_api_key
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_lunar_calendar.py (reported line 58)May include surrounding context.

python

if env_val: return env_val
        
        # 2. .env 文件
        env_file = Path(__file__).parent / ".env"
        if env_file.exists():
            try:
                content = env_file.read_text(encoding="utf-8")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documentation indicates it will use environment variables, read local files such as scripts/.env, and make outbound API requests, but it does not declare any explicit tool scope or allowed-tools restrictions. In an agent setting, missing scope boundaries can cause over-broad execution privileges and reduce transparency about credential access and network exfiltration paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The examples place the API key in the URL query string, which is commonly logged by shells, proxies, browser history, server logs, and monitoring systems. Even if the remote API expects a query parameter, failing to warn users about this exposure increases the chance of credential leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The usage guide instructs users to execute a script with an API key and perform outbound requests, but it does not clearly warn that the key will be transmitted to a third-party service and may be exposed if passed on the command line. In agent environments, omission of credential-handling guidance increases the risk of accidental secret disclosure through process listings, logs, or traces.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring tells users to use --lunar and --json, but the parser only defines --type and does not define any --json option. The code later references args.lunar and args.json, so the documented interface and implemented interface diverge in a way that misrepresents how the script actually behaves.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code builds an HTTP request that includes the user's API key and sends it to the TianAPI endpoint. Although the script's purpose implies a remote lookup, there is no explicit warning in code comments, prints, or the module description that the provided key will be transmitted over the network to a third-party service.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The Config class documents precedence as command line > environment variable > .env file, and _resolve_key implements that order. However, the --key help text says the key is optional and '优先使用环境变量', which contradicts the real behavior where the CLI key takes precedence.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.